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WHAT IS CLAIMED IS: 

1 . A method of forwarding data packets from a source endsystem in a first enterprise local area 
network (LAN) to a destination endsystem in a second enterprise LAN through a plurality of 
multi-protocol labeling system (MPLS)-aware routers on a global network, comprising: 

establishing a first virtual LAN identifier (VLAN-ID) to transport all data packets from 
the source endsystem to an ingress routing device on the global network; 

creating a label-switched path (LSP) through the plurality of MPLS-aware routers to 
transport all of the data packets from the ingress routing device to an egress routing device on 
the global network; and 

establishing a second VLAN-ID to transport the data packets from the egress routing 
device to the destination end system in the second enterprise LAN. 

2. The method of claim 1, wherein the first and second VLAN-IDs are established by a network 
administrator. 

3. The method of claim 1 , wherein the first and second VLAN-IDs are established by a software 
program. 

4. The method of claim 1, wherein the global network is an Internet. 

5. The method of claim 1, wherein a third VLAN-ID is used in conjunction with the first 
VLAN-ID to transport the data packets from the source endsystem to the ingress routing 
device on the global network. 

6. The method of claim 1, wherein a route of the label-switched path is determined by hop-by- 
hop routing. 

7. The method of claim 1, wherein a route of the label-switched path is determined by explicit 
routing. 
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8. The method of claim 1, wherein the ingress router is included in the first VLAN-K). 

9. The method of claim 1, wherein the egress router is included in the second VLAN-ID 

10. A method of forwarding data packets from a source endsystem in a first enterprise local area 
network (LAN) to a destination endsystem in a second enterprise LAN through at least one 
intermediate enterprise LAN and at least two Multi-Protocol Labeling System (MPLS)-aware 
routing segments, comprising: 

establishing a first virtual LAN identifier (VLAN-ID) to transport data packets 
from the source endsystem to a first MPLS-aware routing device in a first of the at least 

t 

P two MPLS-aware routing segments; 

■P creating a label-switched path (LSP) from the first MPLS-aware routing device 

=; through a last MPLS-aware routing device for each routing segment; 

y 5 establishing a VLAN-ID in each intermediate enterprise LAN to transport data 

U packets from a last router on a preceding routing segment to a first router on a succeeding 

O routing segment; and 

flj establishing a second VLAN-ID in the second enterprise LAN to transport data 

packets from the last MPLS-aware routing device on a last routing segment to the 
destination endsystem. 

1 1. The method of claim 10, wherein the first and second VLAN-IDs are created by a software 
program. 

12. The method of claim 10, wherein the first and second VLAN-IDs are created by a network 
administrator. 

13. The method of claim 10, wherein a route of the label-switched path is determined by hop-by- 
hop routing. 
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14. The method of claim 10, wherein a route of the label-switched path is determined by explicit 
routing. 

15. The method of claim 10, wherein the global network is an Internet. 

16. The method of claim 10, wherein the ingress router is included in the first VLAN-ID. 

17. The method of claim 10, wherein the egress router is included in the second VLAN-ID. 

18. A virtual end-to-end circuit to transport packets over a first enterprise network, a global 
network, and a second enterprise network, comprising: 

a packet transfer device to initiate transfer of the packets from one end of the virtual end- 
to-end circuit to another end; 

a virtual local area network (VLAN) in the first enterprise network to transport the 
packets from the packet transfer device through the first enterprise network to an ingress router 
on the global network; 

a label-switched path (LSP) to enable the packets to be transported from the ingress 
router to an egress router on the global network; and 

a second virtual local area network (VLAN) in the second enterprise network to transport 
the packets from the egress router through the second enterprise network to a destination 
endsystem. 

19. The system of claim 18, wherein the global network is an Internet. 

20. The system of claim 18, wherein the packet transfer device is a server. 

21. The system of claim 18, wherein the packet transfer device is a computer workstation. 

22. The system of claim 18, wherein the VLAN is created at a LAN switch. 

23. The system of claim 18, wherein the VLAN is created at an endsystem. 
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24. A virtual end-to-end circuit to receive a group of packets spanning a first enterprise local area 
network (LAN), a global network, and a second enterprise LAN, comprising: 

a packet receiving device in the second enterprise LAN to accept transfer of the group of 
packets over the virtual end-to-end circuit; 

a packet transmitting device in the first enterprise LAN; 

a first virtual local area network (VLAN) to transmit the group of packets securely 
through the first enterprise LAN to an ingress router on the global network; 

a label-switched path in the global network to transmit the group of packets securely from 
the ingress router to an egress router in the global network; and 

a second VLAN to transmit the group of packets securely from the egress router through 
the second enterprise LAN to the packet receiving device. 

25. The system of claim 24, wherein the global network is an Internet. 

26. The system of claim 24, wherein the packet receiving device is a server. 

27. The system of claim 24, wherein the packet receiving device is a computer workstation. 

28. The system of claim 24, wherein the first and second VLANs are created at a LAN switch. 

29. The system of claim 24, wherein the first and second VLANs are created at an endsystem. 
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